Malicious Calendly and Google Meet Links Deliver a Fake Zoom Extension: How to Stay Safe
Learn how attackers are using fake Calendly and Google Meet invites to deliver a weaponized Zoom extension via Telegram. Discover how the attack works, indicators of compromise, and security tips to stay protected.
Quick answer: A reported social engineering campaign sends a meeting request, often through Telegram, with a Calendly link that leads to a fake Google Meet page. During the "meeting setup", the victim is told to install a Zoom extension to fix an audio problem. The download is malware. Never install software or extensions prompted by a meeting page.
Key takeaways
- The lure is a normal-looking meeting invite followed by a "fix your audio" download.
- Real meeting platforms do not need you to install an extension from a chat contact to fix a microphone.
- The malware aims to steal credentials, browser data and possibly crypto wallets or give remote access.
- Verify the sender through another channel, check the domain and install software only from the official site or store.
- If you installed it, disconnect, change passwords from a clean device, revoke sessions and report.
What was reported?
Security reports describe a social engineering campaign in which an attacker contacts a victim, often through a messaging app such as Telegram, posing as a potential client, investor or recruiter. They propose a call and send a Calendly scheduling link. The link leads to a page that imitates a Google Meet meeting. When the victim tries to join, the page claims there is a problem with the microphone or audio and prompts them to download a "Zoom extension" or similar fix. That download is malware. The earlier version of this article did not cite the original vendor report; because of that, details such as specific malware families and indicators are not repeated here. If you need indicators for detection, use the vendor's published report.
How does the lure work, step by step?
- Contact: a stranger or a hijacked account starts a friendly conversation, often about business, investment or a job.
- Scheduling: they send a Calendly link. Calendly itself is a real service, which makes the link look safe.
- Redirect: the scheduling flow ends on a page that looks like Google Meet but is not hosted by Google.
- Problem: the page claims an audio or video fault and offers a fix.
- Download: the victim is asked to install a Zoom extension, app or script. Running it installs malware.
- Theft: the malware may collect browser passwords and cookies, wallet data and files, or provide remote access.
Why does it work?
- It uses trusted brand names and a believable business workflow.
- It creates mild urgency: the meeting is about to start.
- The conversation starts on a chat app where people are relaxed.
- Technical problems during calls are common, so a "fix" seems normal.
What are the red flags?
| Red flag | What to do |
|---|---|
| Unknown contact pushes a meeting quickly | Verify identity through another channel, such as their official company email or LinkedIn |
| The meeting page is not on meet.google.com or zoom.us | Read the full domain before clicking or typing anything |
| A site asks you to install an extension or file to join a call | Do not. Join in the browser, use the official app or reschedule |
| Instructions to run a command or script | Never run commands that a web page gives you |
| Requests to disable security software | Stop. This is a strong sign of malicious intent |
How do you protect yourself and your team?
- Install meeting software only from the official vendor site or app store.
- Keep browser extensions to a minimum and review them regularly.
- Use a password manager, which will not autofill on a fake domain.
- Enable multi-factor authentication, preferably with passkeys or security keys, and keep crypto wallet keys on separate hardware.
- Restrict extension installation on managed browsers with an allowlist.
- Train staff, especially recruiters, founders and finance teams who often get such invitations.
- Use endpoint protection and keep systems updated.
What should you do if you installed it?
- Disconnect the device from the network.
- From a different, clean device, change passwords for email, banking, work and cloud accounts, and revoke active sessions and tokens.
- Move any cryptocurrency to new wallets from a clean device.
- Remove the extension or program and run a full scan, or better, reinstall the system if unsure.
- Tell your IT or security team. In India, report fraud through cybercrime.gov.in or the 1930 helpline, and report incidents to CERT-In if you are an organisation.
Are Calendly and Google Meet unsafe?
No. The services are legitimate. Attackers abuse their reputation, so the issue is the destination page and the request to install something. Check the actual domain and never install software prompted by a meeting page.
Common mistakes
- Trusting a link because the first step was a real Calendly page.
- Running an installer "just to join the call".
- Using the same password across work and personal accounts.
- Waiting before reporting a suspected infection.
Next steps
Read how to protect online video calls from hackers and trojanized GitHub repositories. For structured study, see our cyber security course.
Related reading
Frequently Asked Questions
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Wow
0
Sad
0
Angry
0
Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.
